web
You’re offline. This is a read only version of the page.
close

What can we help you with?

TMS - Requesting and Retrieving Full Primary Account Number (PAN) Response with Token Management Service, Payment Tokenization, or Recurring Billing


KA-08849


20

06/04/2026 16:07 PM

2.0

Requesting and Retrieving Full Primary Account Number (PAN) Response with Token Management Service, Payment Tokenization, or Recurring Billing

Introduction

This article provides instructions for merchants and partners on how to request Full Primary Account Number (PAN) Response for use with Cybersource’s Token Management Service (TMS), Payment Tokenization, or Recurring Billing. It also outlines the steps to securely retrieve unmasked PAN data through the REST API after enablement is complete.

Applicability

  • Applies to merchants and partners using Token Management Service (TMS), Payment Tokenization, or Recurring Billing on Cybersource or the Visa Acceptance Platform.
  • Applies when a merchant or partner needs to retrieve unmasked PAN data for token extractions, reconciliations, or investigations.

Requesting Full PAN Response

Follow these steps to enable Full PAN Response for your organization.

StepActionDetails
1Obtain the Request FormContact Client Services or submit a support case to obtain the correct request form for your platform (Cybersource or Visa Acceptance Platform). This ensures you receive the appropriate form for your account.
2Submit Your RequestComplete the provided form. Only an account administrator may submit the formal request. Attach the completed form and open a support case with Cybersource Support. Specify the relevant merchant, vault, Organization ID, or portfolio Organization ID as applicable. For instructions, see Support — Support Case Management.
3Approval ProcessVisa’s Legal team will review your request. You will be notified once your request is approved and Full PAN Response is enabled for your account. Enablement may take up to one week after approval.

Retrieving Full PAN Data via REST API

Once Full PAN Response is enabled, you can retrieve unmasked PAN data using the Token Management Service REST API.

Requirements

  • Message-Level Encryption (MLE): Register an MLE security key for your Cybersource merchant account in the Enterprise Business Center (EBC). For setup instructions, see the TMS REST API Developer Guide (pages 64–67).

Steps

StepActionDetails
1Make the API RequestUse the Retrieve an Instrument Identifier or Retrieve Payment Instrument endpoints. Add the following header to your API request: Accept: application/jose. See Developer Guide, page 97 for more details.
2Handle the ResponseThe API will return an encrypted JWT containing the unmasked PAN data. Decrypt the JWT using the private key associated with your MLE key to access the full API JSON response, including the unmasked PAN.

Additional Information

  • For portfolio-level payment information decryption, integration with Meta Key and MLE is required.
  • Beginning April 2025, microform will support gateway-agnostic unmasked payment information retrieval for external processing, with MLE required for secure transfer.

Potential Client Questions

  • Who can submit the Full PAN Response request?
    • Only an account administrator can submit the formal request.
  • How long does enablement take?
    • Enablement may take up to one week after Legal approval.
  • What is required to retrieve unmasked PAN data via API?
    • You must register a Message-Level Encryption (MLE) security key in EBC and include the Accept: application/jose header in your API request.
  • How do I read the API response?
    • The response is an encrypted JWT. Decrypt it using the private key associated with your MLE key to view the unmasked PAN.

Additional Resources

    Additional Resources

    Contact Path

    For further assistance, please contact Client Services.



    Was this article helpful?


    Articles Recommended for You